Zscaler IPSec tunnel over Palo alto SD WAN

[Raaj.Mohan]

Hi,

Sorry for the long post.

We have migrated from ASA to Palo alto firewall 445. 

We have Zscaler tunnel from Palo alto with PBF however monitoring was failing to switch over. We have second circuit now, tried to do ECMP with the tunnel interface and nothing worked.

I have added the default route to tunnel (and higher metric to DIA) and changed the PBF policy to select no pbf however the traffic wasn’t going through the tunnel as I have added a monitoring on the static route pointed to Zscaler public ip (tried peer as well as vip address). Monitoring on the static route showed down and PBF was showing up.

I have added tunnel ip address into the encryption domain and the static route monitoring came up, still the traffic wasn’t going through the Zscaler tunnel although the default route is pointed to Zscaler tunnel.

To avoid another failed change, I have removed the static route pointed to the tunnel and added pbf pointed to the tunnel interface as described on the Zscaler documentation and it started working.
https://help.zscaler.com/zia/ipsec-vpn-configuration-guide-palo-alto-networks-firewall#createtunnelm... (I know this is older Palo alto version, probably 8.x however this is the link they shared with us)

I did a failover on the Zscaler tunnel by changing the peer ip address to 1.1.1.1. it didn’t failover to routing table although the tunnel interface shows down and the site went down.
Right now, if the tunnel goes down, we should manually disable the Zscaler PBF to get internet working.

After few hours, TAC team shared an article which says that we cannot use the public ip address to monitor on the tunnel interface with private ip address. They have asked me to speak with SE as it’s a new design and closed the call.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClqvCAC

So decided to go with SD WAN on palo alto and would like to know a simple configuration for a small site with no hub and spoke topology.

Each site goes to internet directly over zscaler and a tunnel to azure bypassing the zscaler on HA Active/Standby firewall over SDWAN (Palo alto and not Prisma). Probably if someone can help me with a simple configuration to configure the firewall through Panorama that will be helpful.

Thanks,

Raaj